rev-dex-dumper
p4nda0s/reverse-skills
Dump DEX files from running Android apps for reverse engineering and deobfuscation.
What is rev-dex-dumper?
Extracts DEX bytecode from a live Android application's memory using ADB and the bundled panda-dex-dumper tool. Use this when you need to unpack APKs, bypass class-loading packers, or recover decrypted DEX files for analysis.
- Dumps DEX files directly from an Android app's memory via ptrace
- Extracts decrypted DEX from packed/obfuscated applications
- Handles multiple DEX outputs from complex class loaders
- Automatically pulls dumped files to your host machine
- Cleans up device artifacts after extraction
How to install rev-dex-dumper
npx skills add https://github.com/p4nda0s/reverse-skills --skill rev-dex-dumper- Android device connected via ADB
- ADB tools installed on host machine
- Device must be rooted or running as root (ptrace requirement)
- Target app must be running on the device
How to use rev-dex-dumper
- 1.Verify ADB connection with `adb devices`
- 2.Push panda-dex-dumper to device and make it executable
- 3.Identify the target app's package name or get the foreground app
- 4.Launch the app and navigate past any splash screens to ensure DEX is loaded
- 5.Run panda-dex-dumper against the app's process ID
- 6.Pull the dumped DEX files from `/data/local/tmp/panda/` to your machine
- 7.Clean up the device by removing the tool and dumped files
Use cases
- Reverse engineering a packed Android app to analyze its real code
- Extracting decrypted DEX from an app that uses runtime encryption
- Defeating class-loading packers by dumping after the packer decrypts
- Analyzing malware samples by extracting their actual bytecode
- Deobfuscating an app by dumping and then using a decompiler
- Android security researchers
- Reverse engineers analyzing APKs
- Malware analysts
- App developers debugging obfuscated code
rev-dex-dumper FAQ
panda-dex-dumper uses ptrace which requires root. Try `adb root` to restart adbd as root, or run the dumper via `su` if the device has a su binary.
The app is not running. Launch it first using `adb shell monkey -p <package_name> -c android.intent.category.LAUNCHER 1` or manually open it on the device.
Packed or complex apps often have multiple DEX files loaded by their class loader. This is normal—pull all files from `/data/local/tmp/panda/` for a complete dump.
Yes. Always remove both the dumped DEX files and the panda-dex-dumper binary from the device to avoid leaving artifacts and wasting storage.
Yes, that's the main purpose. By dumping from memory after the app has decrypted the DEX at runtime, you extract the plaintext bytecode.
Full instructions (SKILL.md)
Source of truth, from p4nda0s/reverse-skills.
name: rev-dex-dumper description: Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.
rev-dex-dumper - Android DEX Dumper
Dump DEX files from a running Android application's memory using panda-dex-dumper via ADB.
Tool Location
The panda-dex-dumper binary is bundled in this skill's directory. Resolve its absolute path relative to this SKILL.md file:
skills/rev-dex-dumper/panda-dex-dumper
Workflow
1. Push the tool to device
adb push <path-to>/panda-dex-dumper /data/local/tmp/
adb shell chmod +x /data/local/tmp/panda-dex-dumper
2. Determine target package name
If the user provides a package name, use it directly. Otherwise, get the foreground app:
adb shell dumpsys activity top | grep 'ACTIVITY' | tail -1 | awk '{print $2}' | cut -d/ -f1
3. Run the dumper
adb shell "cd /data/local/tmp && ./panda-dex-dumper -p $(adb shell pidof <package_name>)"
The dumped DEX files are saved to /data/local/tmp/panda/ on the device.
4. Pull DEX files to host
adb pull /data/local/tmp/panda/ ./
Pull to the user's current working directory.
5. Clean up device cache
adb shell rm -rf /data/local/tmp/panda/
adb shell rm /data/local/tmp/panda-dex-dumper
Guidelines
- Always verify ADB connection first — run
adb devicesand confirm a device is listed before proceeding. - Root may be required —
panda-dex-dumperusesptraceto attach to the target process. If the device is not rooted, the dump will fail. Suggestadb rootor running viasuif needed. - Wait for app to fully load — if the user is dumping a packed app, the real DEX is only available after the packer's class loader has decrypted it. Advise the user to navigate past the splash screen before dumping.
- Handle pidof failure — if
pidofreturns empty, the app may not be running. Launch it first withadb shell monkey -p <package_name> -c android.intent.category.LAUNCHER 1. - Multiple DEX files are normal — packed apps often produce several DEX files. All files in
/data/local/tmp/panda/should be pulled. - Always clean up — remove both the dumped DEX files and the tool binary from the device after pulling results to avoid leaving artifacts.
Related skills
More from p4nda0s/reverse-skills and the wider catalog.
rev-frida
Generate Frida hook scripts for dynamic analysis, runtime tracing, and method interception on Android and native targets.
rev-idapython
IDAPython and IDALib script reference for reverse engineering and binary analysis.
rev-struct
Reconstruct data structures by analyzing memory access patterns across functions
rev-symbol
Recover function symbols by analyzing code patterns, strings, constants, and cross-references in decompiled binaries.
rev-u3d-dump
Extract C# method names and addresses from Unity IL2CPP iOS/Android builds for IDA/Ghidra reverse engineering.
rev-unicorn-debug
Debug and emulate code fragments using the Unicorn engine with environment simulation.